Malicious PDF — malware analysis report

Static analysis result for SHA-256 4fb6fd91fbfc7760…

MALICIOUS

PDF

76.3 KB Created: 2021-04-06 22:23:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: e6bf678bae239b5d233fa839a0819509 SHA-1: b86aed92bb3760f44560bd39d1606dedeacd33b2 SHA-256: 4fb6fd91fbfc7760295d54e68135b8248132050309f2bec7c5694612e76db89a
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL disguised as a benign document. The ML classifier and ClamAV detection strongly indicate malicious intent. The embedded URL, https://nipisod.ru/strik?utm_term=what+is+classical+literature+pdf, is likely used to redirect the user to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=what+is+classical+literature+pdf PDF link annotation
    • http://jonariz.22web.org/50899611562.pdfIn PDF document text
    • http://saluzoz.iblogger.org/malayalam_movie_maradona_songs.pdfIn PDF document text
    • http://fegokodelaxen.scienceontheweb.net/14054642621.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462775/normal_5fd0fe0b25661.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427528/normal_603bfffa29b59.pdfIn PDF document text
    • http://bigijawiv.scienceontheweb.net/centrales_termicas.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405459/normal_602d698082548.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/setigafat/automorphic_forms_and_representations.pdfIn PDF document text
    • https://s3.amazonaws.com/bezorito/barigolulitubisiv.pdfIn PDF document text
    • https://s3.amazonaws.com/silubebebefuju/contemporary_nursing_issues_trends__management_8th_edition.pdfIn PDF document text
    • https://s3.amazonaws.com/niporofez/himno_al_maestro_peruano_letra_completa.pdfIn PDF document text
    • http://woremekaredito.epizy.com/bojekalexuwurekevomadegar.pdfIn PDF document text
    • http://zeviruzokosobi.epizy.com/objective_biology_free_download.pdfIn PDF document text
    • http://xokudofek.epizy.com/how_to_setup_bose_acoustimass_10.pdfIn PDF document text
    • http://voxotili.epizy.com/illinois_appellate_court_first_district_case_information.pdfIn PDF document text
    • http://lopusenegi.epizy.com/fimulu.pdfIn PDF document text
    • http://xezepagonozaniw.epizy.com/6827347755.pdfIn PDF document text
    • http://zikinevubebera.epizy.com/hearthstone_kobolds_and_catacombs_boss_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/dorulusof/gavuvunagogixigoj.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee6b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE6B 5256 bytes
SHA-256: c7cfcecebef6fdf9fefb596a7677e89789a0c7cc392248522178d1b0703a5548
font_01_sfnt_off00010052.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10052 10628 bytes
SHA-256: c1055ea2f73823d60a7c564493b5051a5ffaf49d8d4b0fd84c51b4791b8d3f9b

Open this report in the interactive analyzer, or submit your own file for analysis.